CVE-2025-23199: medium-severity vulnerability in librenms
Stored XSS-LibreNMS-Ports in librenms
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
No sign of exploitation. No public exploitation artifact known so far.
LibreNMS allows attackers to inject malicious scripts into port descriptions that execute when users view the affected page. This can lead to unauthorized actions or theft of sensitive data.
Stored XSS vulnerability in `/ajax_form.php` parameter `descr` allows remote attackers to persist malicious JavaScript that executes in the context of other users' browsers. Exploitation requires ability to modify port descriptions; impact includes session hijacking, credential theft, and unauthorized administrative actions. Fixed in version 24.11.0.
In the same product, most dangerous first.